# CVE-2026-103539: ZongXR SuperMarket authentication bypass in Instant Buy

Source: https://junglewise.ai/threats/cve-2026-103539-a-weakness-has-been-identified-in-zongxr-supermarket-1-0-0-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103539 · Severity: medium · CVSS 5.4 · Published 2026-10-01

ZongXR SuperMarket is an online marketplace platform built with Spring Cloud and Java. An attacker can bypass authentication in the flash-sale purchasing feature by manipulating the username parameter in requests, allowing them to fraudulently claim another user has already completed a purchase and permanently blocking that user from participating in the sale.

Technologies: [ZongXR SuperMarket](https://junglewise.ai/threats/technologies/supermarket). Vendors: [ZongXR](https://junglewise.ai/threats/vendors/zongxr).

## Quick answers

**Is CVE-2026-103539 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103539 being exploited in the wild.

**How severe is CVE-2026-103539?** Medium severity, with a CVSS score of 5.4, published 1 October 2026.

**Which products and versions are affected?** ZongXR SuperMarket 1.0.0.0.

**Is there a fix for CVE-2026-103539?** No fixed version is recorded yet. Remove the userName path parameter and retrieve the authenticated user from the security context using Authentication.getName() instead. Alternatively, validate that the userName in the path parameter matches the identity of the currently authenticated user before processing the purchase request. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103539 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103539?** Check whether you run ZongXR SuperMarket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Remove the userName path parameter and retrieve the authenticated user from the security context using Authentication.getName() instead. Alternatively, validate that the userName in the path parameter matches the identity of the currently authenticated user before processing the purchase request.

## Technical details

The InstantBuyController's startBuy endpoint accepts a userName path parameter without validating it against the authenticated user's identity, enabling privilege escalation. An attacker can invoke GET /instantbuy/manage/{itemId}/{arbitrary-username} to trigger purchase state changes (inventory decrement, Redis flag, database record insertion) for any victim username. The vulnerability affects the Instant Buy component across the controller, service, and message consumer layers, allowing manipulation of purchase eligibility and inventory records.

## Affected products

- ZongXR SuperMarket 1.0.0.0

## Timeline

- 2026-09-03: disclosed: Vulnerability reported via GitHub issue #30
- 2026-10-01: advisory: CVE-2026-103539 published

## References

- [https://github.com/ZongXR/SuperMarket/](https://github.com/ZongXR/SuperMarket/)
- [https://github.com/ZongXR/SuperMarket/issues/30](https://github.com/ZongXR/SuperMarket/issues/30)

## Related threats

- [ZongXR SuperMarket authentication bypass in order deletion](https://junglewise.ai/threats/cve-2026-103538-a-security-flaw-has-been-discovered-in-zongxr-supermarket-1-0-0)
- [ZongXR SuperMarket authentication bypass in order endpoint](https://junglewise.ai/threats/cve-2026-103536-a-vulnerability-was-identified-in-zongxr-supermarket-1-0-0-0)